空のパスワードによるLDAP認証バイパス

The primary impact of CVE-2020-26214 is unauthorized access to the Alerta Server. An attacker who can bypass LDAP authentication can gain access to sensitive data and potentially compromise the entire system. This could involve modifying alert configurations, creating or deleting users, and disrupting monitoring operations. The vulnerability is particularly concerning because it leverages a misconfiguration on the LDAP server side, rather than a flaw within Alerta Server itself. Exploitation requires the LDAP server to be configured to allow unauthenticated binds, a common default setting on Active Directory installations.

Organizations using Alerta Server for incident monitoring and alerting, particularly those relying on LDAP for authentication and using default Active Directory configurations, are at risk. Shared hosting environments where LDAP server configurations are managed centrally are also potentially vulnerable.

• python / server:

# Check Alerta Server version
alerta-server --version

• python / server:

# Check LDAP configuration in alerta.yml for allow_empty_password
grep -r 'allow_empty_password' /etc/alerta/alerta.yml

• generic web:

# Attempt authentication with an empty password and check for 401 Unauthorized
curl -u '' http://<alerta_server_ip>/auth/login

1. 2020-11-06Disclosure

   disclosure

1. 予約済み2020-10-01
2. 公開日2020-11-06
3. 更新日2026-03-13
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2020-26214 is to upgrade Alerta Server to version 8.1.0 or later, which includes a fix that returns an HTTP 401 Unauthorized response for empty password authentication attempts. If upgrading is not immediately feasible, LDAP administrators can implement a workaround by disallowing unauthenticated bind requests from clients. This can be configured within the LDAP server itself. Monitor LDAP logs for unusual authentication attempts, particularly those with empty passwords. After upgrading, confirm the fix by attempting authentication with an empty password and verifying that it results in a 401 Unauthorized response.